Bitget Resumes Bitcoin Withdrawals After $388M Hack; Hacker Launders ETH via THORChain

Bitget has resumed Bitcoin withdrawals following a $388 million security breach on September 24 that compromised part of the exchange's hot and warm wallet infrastructure. CEO Gracy Chen announced during a Monday ask-me-anything session that BTC withdrawals on the Bitcoin network and BNB Smart Chain were restored first, with Ether (ETH) withdrawals scheduled to return Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism. Tether's USDt (USDT) withdrawals are set to resume Wednesday across Ethereum, BNB Smart Chain, Solana, and Tron, with all other assets and peer-to-peer services following by Friday. The recovery timeline applies uniformly to all users, with no priority access for institutional or VIP clients.

Bitget revised its estimated losses upward from $351.6 million to $387.5 million after accounting for additional stolen transfers on Zcash and Tron, though cold wallets remained secure throughout the incident. Meanwhile, blockchain analytics platform Lookonchain reported that the attacker was actively swapping stolen Ether for Bitcoin through THORChain, a decentralized cross-chain swapping protocol. Arkham data confirmed ETH linked to the attacker flowing into THORChain vaults, complicating efforts to trace and recover the funds.

Chen has called on THORChain to refuse services to addresses linked to the attack, but THORChain responded that its network halt mechanism is an emergency security tool affecting the protocol broadly and cannot selectively freeze specific funds or individual swaps. Crypto author Anndy Lian noted that THORChain can halt trading, stop outbound transactions, or pause a connected chain, but these measures impact all users indiscriminately. The protocol currently lacks a built-in address blacklist, limiting its ability to block specific bad actors—a structural challenge highlighting tensions between decentralization principles and post-exploit asset recovery.